CI: add repository checks to prevent workflow failures on forks

[alastori]

What is changed, added or deleted? (Required)

Add repository checks (if: github.repository == 'pingcap/docs') to workflows that use secrets, preventing failures when contributors fork the repository.

Why

When users fork pingcap/docs, workflows requiring secrets fail because GitHub does not expose repository secrets to forks (a security feature). This causes:

• Confusing red X marks on fork commits
• Noisy workflow failure notifications
• Unnecessary compute cycles on skipped-but-failed jobs

Changes

Added if: github.repository == 'pingcap/docs' condition to jobs in:

Workflow	Secret(s) Used
dispatch.yml	DOCS_STAGING
rebase.yml	REBASE_SECRET_KEY
ja-full-translation-google.yaml	GCP_KEY, GCP_PROJECT_ID, GCP_GLOSSARY_ID, DOCS_STAGING
translation-cron.yml	GCP_KEY, GCP_PROJECT_ID, GCP_GLOSSARY_ID, DOCS_STAGING
translation-zh.yaml	LANGLINK_ACCESS_KEY, LANGLINK_ACCESS_SECRET, LANGLINK_USER
translation-zh-switch.yaml	LANGLINK_ACCESS_KEY, LANGLINK_ACCESS_SECRET, LANGLINK_USER
sync-cloud-zh-toc.yml	GEMINI_API_TOKEN
sync-doc-pr-zh-to-en.yml	DEEPSEEK_API_TOKEN, GEMINI_API_TOKEN
media.yml	QINIU_ACCESS_KEY, QINIU_SECRET_KEY, QINIU_BUCKET_NAME
bot.yaml	Repository-specific scheduled job
link.yaml	Repository-specific scheduled job

Pattern

This is a standard GitHub Actions pattern for handling fork workflows:

Already used in this repository:

• media.yml (733efab)
• bot.yaml (eb6912e)
• link.yaml (341a1e2)

Used by major open-source projects:

• rust-lang/rust - uses github.repository == 'rust-lang/rust'
• rust-lang/rust-analyzer - uses same pattern for release workflows
• Discussed in actions/runner#859 as the recommended approach

Validation

Tested on fork (alastori/tidb-docs):

Workflow	Trigger	Result
translation-zh.yaml	workflow_dispatch	✅ Job skipped (guard working)
bot.yaml	workflow_dispatch	✅ Job skipped (guard working)
link.yaml	workflow_dispatch	✅ Job skipped (guard working)
ci.yaml	pull_request	✅ Runs normally (no guard needed)
link-fail-fast.yaml	pull_request	✅ Runs normally (no guard needed)

Which TiDB version(s) do your changes apply to? (Required)

• master (CI/infrastructure change, not version-specific)

What is the related PR or file link(s)?

• Prior fixes in this repo: 733efab, eb6912e, 341a1e2
• GitHub docs: Using secrets in a workflow
• Feature request for native support: actions/runner#859

Do your changes match any of the following descriptions?

• Delete files
• Change aliases
• Need modification after applied to another branch
• Might cause conflicts after applied to another branch

[gemini-code-assist]

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

[pingcap-cla-assistant]

All committers have signed the CLA.

[alastori]

Hi @shhdgit @qiancai @Oreoxmt - this PR adds repository guards to workflows that use secrets, following the same pattern already used in media.yml, bot.yaml, and link.yaml. Would appreciate a review when you have a chance. Thanks!

[qiancai]

/approve

[ti-chi-bot]

[LGTM Timeline notifier]

Timeline:

• 2026-01-20 02:54:05.063164832 +0000 UTC m=+462472.677121698: ☑️ agreed by Oreoxmt.
• 2026-01-21 01:15:40.37077833 +0000 UTC m=+542967.984735187: ☑️ agreed by qiancai.

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: qiancai

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [qiancai]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ti-chi-bot]

@qiancai: You cannot manually add or delete the cherry pick approval state labels, only I and the tursted members have permission to do so. You can approve it in internal platform.

Details

In response to removing label named approved.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the ti-community-infra/tichi repository.